[PM-28029] Address Sonar Cloud and Linter errors (#6151)

.github/actions/log-inputs/action.yml

@@ -11,10 +11,14 @@ runs:
   steps:
     - name: Log inputs to job summary
       shell: bash
+      env:
+          INPUTS: ${{ inputs.inputs }}
       run: |
-        echo "<details><summary>Job Inputs</summary>" >> $GITHUB_STEP_SUMMARY
+        {
-        echo "" >> $GITHUB_STEP_SUMMARY
+          echo "<details><summary>Job Inputs</summary>"
-        echo '```json' >> $GITHUB_STEP_SUMMARY
+          echo ""
-        echo '${{ inputs.inputs }}' >> $GITHUB_STEP_SUMMARY
+          echo '```json'
-        echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "$INPUTS"
-        echo "</details>" >> $GITHUB_STEP_SUMMARY
+          echo '```'
+          echo "</details>"
+        } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/_version.yml

@@ -73,25 +73,31 @@ jobs:
           inputs: "${{ toJson(inputs) }}"
 
       - name: Echo distinct ID ${{ github.event.inputs.distinct_id }}
-        run: echo ${{ github.event.inputs.distinct_id }}
+        env:
+          _DISTINCT_ID: ${{ inputs.distinct_id }}
+        run: echo "${_DISTINCT_ID}"
 
       - name: Check out repository
         if: ${{ !inputs.skip_checkout || false }}
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Calculate version name
         id: calc-version-name
+        env:
+          _VERSION_NAME: ${{ inputs.version_name }}
+          _PATCH_VERSION: ${{ inputs.patch_version }}
         run: |
           output() {
             local version_name=$1
-            echo "version_name=$version_name" >> $GITHUB_OUTPUT
+            echo "version_name=$version_name" >> "$GITHUB_OUTPUT"
           }
 
           # override version name if provided
-          if [[ ! -z "${{ inputs.version_name }}" ]]; then
+          if [[ ! -z "${_VERSION_NAME}" ]]; then
-            version_name=${{ inputs.version_name }}
+            version_name=${_VERSION_NAME}
             echo "::warning::Override applied: $version_name"
             output "$version_name"
             exit 0
@@ -102,7 +108,7 @@ jobs:
 
           latest_tag_version=$(git tag -l --sort=-creatordate | grep "$APP_CODENAME" | head -n 1)
           if [[ -z "$latest_tag_version" ]]; then
-            version_name="${current_year}.${current_month}.${{ inputs.patch_version || 0 }}"
+            version_name="${current_year}.${current_month}.${_PATCH_VERSION:-0}"
             echo "::warning::No tags found, did you checkout? Calculating version from current date: $version_name"
             output "$version_name"
             exit 0
@@ -111,14 +117,14 @@ jobs:
           # Git tag was found, calculate version from latest tag
           latest_version=${latest_tag_version:1}  # remove 'v' from tag version
 
-          latest_major_version=$(echo $latest_version | cut -d "." -f 1)
+          latest_major_version=$(echo "$latest_version" | cut -d "." -f 1)
-          latest_minor_version=$(echo $latest_version | cut -d "." -f 2)
+          latest_minor_version=$(echo "$latest_version" | cut -d "." -f 2)
           patch_version=0
-          if [[ ! -z "${{ inputs.patch_version }}" ]]; then
+          if [[ ! -z "${_PATCH_VERSION}" ]]; then
-            patch_version=${{ inputs.patch_version }}
+            patch_version=${_PATCH_VERSION}
             echo "::warning::Patch Version Override applied: $patch_version"
           elif [[ "$current_year" == "$latest_major_version" && "$current_month" == "$latest_minor_version" ]]; then
-            latest_patch_version=$(echo $latest_version | cut -d "." -f 3)
+            latest_patch_version=$(echo "$latest_version" | cut -d "." -f 3)
             patch_version=$(($latest_patch_version + 1))
           fi
 
@@ -127,30 +133,38 @@ jobs:
 
       - name: Calculate version number
         id: calc-version-number
+        env:
+          _VERSION_NUMBER: ${{ inputs.version_number }}
         run: |
           # override version number if provided
-          if [[ ! -z "${{ inputs.version_number }}" ]]; then
+          if [[ ! -z "${_VERSION_NUMBER}" ]]; then
-            version_number=${{ inputs.version_number }}
+            version_number=${_VERSION_NUMBER}
             echo "::warning::Override applied: $version_number"
-            echo "version_number=$version_number" >> $GITHUB_OUTPUT
+            echo "version_number=$version_number" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          version_number=$(($GITHUB_RUN_NUMBER + ${{ env.BASE_VERSION_NUMBER }}))
+          version_number=$(($GITHUB_RUN_NUMBER + ${BASE_VERSION_NUMBER}))
-          echo "version_number=$version_number" >> $GITHUB_OUTPUT
+          echo "version_number=$version_number" >> "$GITHUB_OUTPUT"
 
       - name: Create version info JSON
+        env:
+          _VERSION_NUMBER: ${{ steps.calc-version-number.outputs.version_number }}
+          _VERSION_NAME: ${{ steps.calc-version-name.outputs.version_name }}
         run: |
-          json='{
+          json=$(cat <<EOF
-            "version_number": "${{ steps.calc-version-number.outputs.version_number }}",
+          {
-            "version_name": "${{ steps.calc-version-name.outputs.version_name }}"
+            "version_number": "${_VERSION_NUMBER}",
-          }'
+            "version_name": "${_VERSION_NAME}"
+          }
+          EOF
+          )
           echo "$json" > version_info.json
 
-          echo "## version-info.json" >> $GITHUB_STEP_SUMMARY
+          echo "## version-info.json" >> "$GITHUB_STEP_SUMMARY"
-          echo '```json' >> $GITHUB_STEP_SUMMARY
+          echo '```json' >> "$GITHUB_STEP_SUMMARY"
-          echo "$json" >> $GITHUB_STEP_SUMMARY
+          echo "$json" >> "$GITHUB_STEP_SUMMARY"
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload version info artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/build-authenticator.yml

@@ -36,7 +36,6 @@ env:
 permissions:
   contents: read
   packages: read
-  id-token: write
 
 jobs:
   version:
@@ -48,7 +47,6 @@ jobs:
       version_name: ${{ inputs.version-name }}
       version_number: ${{ inputs.version-code }}
       patch_version: ${{ inputs.patch_version && '999' || '' }}
-    secrets: inherit
 
   build:
     name: Build Authenticator
@@ -56,17 +54,9 @@ jobs:
 
     steps:
       - name: Log inputs to job summary
-        env:
+        uses: bitwarden/android/.github/actions/log-inputs@main
-          INPUTS: ${{ toJson(inputs) }}
+        with:
-        run: |
+          inputs: "${{ toJson(inputs) }}"
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Check out repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -124,6 +114,8 @@ jobs:
       - version
       - build
     runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/build.yml

@@ -37,7 +37,6 @@ env:
 permissions:
   contents: read
   packages: read
-  id-token: write
 
 jobs:
   version:
@@ -50,7 +49,6 @@ jobs:
       version_name: ${{ inputs.version-name }}
       version_number: ${{ inputs.version-code }}
       patch_version: ${{ inputs.patch_version && '999' || '' }}
-    secrets: inherit
 
   build:
     name: Build
@@ -58,17 +56,9 @@ jobs:
 
     steps:
       - name: Log inputs to job summary
-        env:
+        uses: bitwarden/android/.github/actions/log-inputs@main
-          INPUTS: ${{ toJson(inputs) }}
+        with:
-        run: |
+          inputs: "${{ toJson(inputs) }}"
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Check out repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -133,6 +123,8 @@ jobs:
       - version
       - build
     runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/publish-store.yml

@@ -68,17 +68,9 @@ jobs:
 
     steps:
       - name: Log inputs to job summary
-        env:
+        uses: bitwarden/android/.github/actions/log-inputs@main
-          INPUTS: ${{ toJson(inputs) }}
+        with:
-        run: |
+          inputs: "${{ toJson(inputs) }}"
-          {
-            echo "<details><summary>Job Inputs</summary>"
-            echo ""
-            echo '```json'
-            echo "$INPUTS"
-            echo '```'
-            echo "</details>"
-          }  >> "$GITHUB_STEP_SUMMARY"
 
       - name: Check out repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0